The SPIN Model Checker
|
|
- Conrad Lang
- 6 years ago
- Views:
Transcription
1 The SPIN Model Checker Metodi di Verifica del Software Andrea Corradini Lezione Slides liberamente adattate da Logic Model Checking, per gentile concessione di Gerard J. Holzmann
2 2 Why focus on SPIN? directly targets software, rather than hardware verification good example of the automata theoretic approach better to understand one system really well, so that you can use it effectively, rather than many different systems partially (?) based on well-understood theory of ω-automata and linear temporal logic 2001 ACM Software Systems Award (other winning software systems include: Unix, TCP/IP, WWW, Tcl/Tk, Java) distributed freely as research tool, well-documented, actively maintained, growing user-base, users in both academia and industry annual Spin user workshops series held since 1995
3 3 types of correctness requirements some requirements are standard: a system (e.g., an OS) should not be able to deadlock no process should be able to starve another no explicitly stated assertion inside a process should ever fail the most important requirements are application specific: system invariants, process assertions effective progress requirements proper termination general causal and temporal relations on states e.g., when a request is issued eventually a reply is returned fairness assumptions, e.g., about process scheduling etc. etc.
4 the choice of the model depends on the requirements that must be checked 4 a good model is always an abstraction of reality it should have less detail than the artifact being modeled the level of detail is selected based on its relevance to the correctness requirements the objective is to gain analytical power by reducing detail the purpose of a model is to explain and predict if it can do neither because it is either too approximate or too detailed, it is not a good model a model is a design aid it often goes through different versions, describing different aspects of reality, and can slowly become more accurate, without becoming more detailed accuracy!= detail
5 building verification models we want to be able to make separate statements about system design and about system requirements therefore we will need two notations/formalisms one for specifying behavior (system design) one for specifying requirements (correctness properties) the two types of statements combined define a verification model a model checker can now: check that the behavior specification (the design) is logically consistent with the requirements specification (the desired properties of the design) the formalism must be defined in such a way that we can guarantee the decidability of any property we can state for any system we can specify 5
6 6 Spin verification models are used to define abstractions of distributed system designs the specification language must support all essential aspects of distributed systems software, and discourage the specification of any redundant detail there are 3 basic types of objects in a Spin verification model: asynchronous processes global and local data objects message channels global data process0 process1 local data message channels local data
7 7 hello world as a Spin model active proctype main() { } these are keywords main is not a keyword printf( hello world\n ) this is a bit like C no semi-colon here start s a simulation run: $ spin hello.pml hello world 1 process created $ a verification run: $ spin a a hello.pml $ gcc o o pan pan.c $./pan... depth depth reached 2, 2, errors: 0 $ 0 print automaton s 1 stop
8 a more interesting example: two processes a card reader and a line printer 8 process 1 process 2?A?B?B?A!A!B!B!A?A reserve printer device?b reserve card reader!a release printer device!b release card reader
9 the corresponding Spin model (don t worry about the details just yet) 9 $ cat generic.pml bool printer = true; /* initially both devices */ bool reader = true; /* are available */ active [2] proctype user() { do :: (printer) -> printer = false; (reader) -> reader = false; /* print cards */ printer = true; /* available */ reader = true } $ :: (reader) -> reader = false; (printer) -> printer = false; /* print cards */ reader = true; printer = true od
10 a simulation of 20 steps $ spin -v -u20 generic.pml 0: proc - (:root:) creates proc 1 (user) 1: proc 0 (user) line 6 "generic.pml" (state 13)[(printer)] 2: proc 0 (user) line 7 "generic.pml" (state 2) [printer = 0] 3: proc 0 (user) line 8 "generic.pml" (state 3) [(reader)] 4: proc 1 (user) line 6 "generic.pml" (state 13)[(reader)] 5: proc 0 (user) line 8 "generic.pml" (state 4) [reader = 0] 6: proc 1 (user) line 13 "generic.pml" (state 8) [reader = 0] 7: proc 0 (user) line 10 "generic.pml" (state 5) [printer = 1] 8: proc 1 (user) line 14 "generic.pml" (state 9) [(printer)] 9: proc 1 (user) line 14 "generic.pml" (state 10)[printer = 0] 10: proc 0 (user) line 11 "generic.pml" (state 6) [reader = 1] 11: proc 0 (user) line 19 "generic.pml" (state 14)[.(goto)] 12: proc 0 (user) line 6 "generic.pml" (state 13)[(reader)] 13: proc 1 (user) line 16 "generic.pml" (state 11)[reader = 1] 14: proc 1 (user) line 17 "generic.pml" (state 12)[printer = 1] 15: proc 1 (user) line 19 "generic.pml" (state 14)[.(goto)] 16: proc 1 (user) line 6 "generic.pml" (state 13)[(reader)] 17: proc 0 (user) line 13 "generic.pml" (state 8) [reader = 0] 18: proc 1 (user) line 13 "generic.pml" (state 8) [reader = 0] 19: proc 0 (user) line 14 "generic.pml" (state 9) [(printer)] 20: proc 1 (user) line 14 "generic.pml" (state 9) [(printer)] depth-limit (-u20 steps) reached #processes: 2 printer = 1 reader = 0 20: proc 1 (user) line 14 "generic.pml" (state 10) 20: proc 0 (user) line 14 "generic.pml" (state 10) 2 processes created $ 10
11 11 a verification (checking a default property: absence of deadlock) $ spin -a generic.pml $ gcc DBFS o pan pan.c $./pan pan: invalid end state (at depth 4) pan: wrote generic.pml.trail (Spin Version November 2003) Warning: Search not completed + Using Breadth-First Search + Partial Order Reduction Full statespace search for: never claim - (none specified) assertion violations + cycle checks - (disabled by -DSAFETY) invalid end states + State-vector 20 byte, depth reached 4, errors: 1 44 states, stored 44 nominal states (stored-atomic) 16 states, matched 60 transitions (= stored+matched) 0 atomic steps hash conflicts: 0 (resolved) (max size 2^18 states) spin s euphemism for deadlock stopped at first error found memory usage (Mbyte) $
12 12 inspection of the error trail $ spin -t -v generic.pml 1: proc 1 (user) line 7 "generic.pml" (state 1) [(printer)] 2: proc 1 (user) line 7 "generic.pml" (state 2) [printer = 0] 3: proc 0 (user) line 13 "generic.pml" (state 7) [(reader)] 4: proc 0 (user) line 13 "generic.pml" (state 8) [reader = 0] spin: trail ends after 4 steps #processes: 2 printer = 0 reader = 0 4: proc 1 (user) line 8 "generic.pml" (state 3) 4: proc 0 (user) line 14 "generic.pml" (state 9) 2 processes created $ process 1 process 2?A?B printer == 0?B &&?A reader == 0 deadlock
13 the Spin gui getting fancy 13
14 14 Acronyms: Spin, Promela, and LTL Spin : Simple Promela Interpreter, a nested acronym Promela: Process Meta Language, for behavior specification LTL : Linear Temporal Logic, for property specification Spin: model checker generator Promela: non-deterministic, guarded command language for specifying the possible system behaviors in a distributed system design systems of interacting, asynchronous threads of execution the purpose is not to prevent the specification of bad or unstructured designs (on the contrary) e.g., gotos are supported the purpose is to allow the specification of designs in such a way that they can be checked with a model checker
15 15 context Promela behavior model correctness property e.g., in LTL -v SPIN -i -a pan.c model checking code C compiler executable model checker random and interactive model simulation guided simulation -t error-trails counter-examples to correctness properties
16 16 central concepts finite-state models only: Promela models are always bounded boundedness in our case guarantees decidability finite state models can still permit infinite executions asynchronous behavior no hidden global system clock no implied synchronization between processes non-deterministic control structures to support (inspire?) abstraction from implementation level detail executability as a core part of the semantics every basic and compound statement is defined by a precondition and an effect a statement can be executed, producing the effect, only when its precondition is satisfied; otherwise, the statement is blocked example: q?m when channel q is non-empty, retrieve message m else block (i.e., wait)
17 17 3 types of objects processes global and local data objects message channels global data process0 process1 local data message channels local data
18 18 processes process behavior is declared in proctype declarations a process is an instantiated proctype processes can be instantiated in two ways: in the initial system state by adding the prefix active to a proctype declaration in any other reachable system state with a run operator active [2] proctype eager() { run eager(); run eager() } 2 processes instantiated in initial system state each process tries to instiantiate 2 more copies, and then terminates
19 19 the proctype eager active [2] proctype eager() { run eager(); run eager() } actions label state transitions not states run eager() run eager() semi-colons are statement separators not statement terminators stop 7 why is this still a finite model? run is a Promela operator run eager( ) is a restricted form of a Promela expression an expression can be used as a statement in Promela run either returns the pid of the process it instantiates or it returns 0 if no new process can be instantiated an expression statement is executable iff it evaluates to non-zero.. the maximum number of active processes is 255 (imposing the bound)
20 no active prefix used in this case init is a predefined initial process (optional) two assignments with run expressions on the right print statement init plus two copies of irun run proctype irun(byte x) { printf( it is me %d, %d\n, x, _pid) } init { pid a, b; a = run irun(1); b = run irun(2); printf( I created %d and %d\n, a, b) } $ spin irun.pml it is me 1, 1 I created 1 and 2 it is me 2, 2 3 processes created $ default indentation of output (output of process i gets i+1 tab-stops) suppressed with spin T option two local variables, invisible outside init x is a local variable inside irun, initialized at process initialization _pid is a predefined local variable pid and byte are data-types parameter passing interleaving of statement executions 3 asynchronous processes running. 1 of 6 possible interleavings... assignments and print statements are unconditionally executable expression statements are only executable when they evaluate to true 20
21 21 process interaction and process state processes can synchronize their behavior in 2 ways through the use of global (shared) variables via message passing through channels buffered channels or rendezvous channels there is no global clock that could be used for synchronization each process has its own local state process program-counter (i.e., control-flow point) values of all locally declared variables the model as a whole has a global state the value of all globally declared variables the contents of all message channels the set of all currently active processes
22 22 dynamic process creation the state of the complete system is maintained in a global state vector the state vector contains entries for the value of all global variables (including message channels) all active processes each active process containing: the value of all locally declared variables the program counter (the control-flow point) globals process 1 process 2 process n the process created first e.g., init the process created last
23 23 state vector contains a process stack globals process 1 process 2 process n the process created first e.g., init the process created last processes are added and deleted in stack (LIFO) order a process can start and stop at any time, but it can disappear from the state vector only in LIFO order process deletion takes 2 steps: termination and then death before a parent can die, all its children must die first a process pid is only recycled when the process has died an init process always dies last: the first pid can never be recycled
24 24 how is finiteness preserved? Promela models are necessarily finite-state: there can be only finitely many active processes there can only be finitely many statements in a proctype all data types have a strictly bounded range e.g., the range of a bit or bool is 0..1, the range of a pid or byte is , the range of a short is , and the range of an int is all message channels have a bounded capacity
The SPIN Model Checker
The SPIN Model Checker Metodi di Verifica del Software Andrea Corradini GianLuigi Ferrari Lezione 3 2011 Slides per gentile concessione di Gerard J. Holzmann 2 the do-statement do :: guard 1 -> stmnt 1.1
More informationSPIN: Introduction and Examples
SPIN: Introduction and Examples Alessandra Giordani agiordani@disi.unitn.it http://disi.unitn.it/~agiordani Formal Methods Lab Class, September 28, 2014 *These slides are derived from those by Stefano
More informationPatrick Trentin Formal Methods Lab Class, March 03, 2017
Spin: Introduction Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/trentin Formal Methods Lab Class, March 03, 2017 These slides are derived from those by Stefano Tonetta, Alberto Griggio,
More informationThe Spin Model Checker : Part I/II
The Spin Model Checker : Part I/II Moonzoo Kim CS Dept. KAIST Korea Advanced Institute of Science and Technology Motivation: Tragic Accidents Caused by SW Bugs 2 Cost of Software Errors June 2002 Software
More informationPatrick Trentin Formal Methods Lab Class, Feb 26, 2016
Spin: Introduction Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/~trentin Formal Methods Lab Class, Feb 26, 2016 These slides are derived from those by Stefano Tonetta, Alberto Griggio,
More informationComputer Lab 1: Model Checking and Logic Synthesis using Spin (lab)
Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab) Richard M. Murray Nok Wongpiromsarn Ufuk Topcu Calornia Institute of Technology AFRL, 25 April 2012 Outline Spin model checker: modeling
More informationTool demonstration: Spin
Tool demonstration: Spin 1 Spin Spin is a model checker which implements the LTL model-checking procedure described previously (and much more besides). Developed by Gerard Holzmann of Bell Labs Has won
More informationFormal Methods for Software Development
Formal Methods for Software Development Verification with Spin Wolfgang Ahrendt 07 September 2018 FMSD: Spin /GU 180907 1 / 34 Spin: Previous Lecture vs. This Lecture Previous lecture Spin appeared as
More informationThe Spin Model Checker : Part I. Moonzoo Kim KAIST
The Spin Model Checker : Part I Moonzoo Kim KAIST Hierarchy of SW Coverage Criteria Complete Value Coverage CVC (SW) Model checking Complete Path Coverage CPC Concolic testing All-DU-Paths Coverage ADUP
More informationINF5140: Specification and Verification of Parallel Systems
INF5140: Specification and Verification of Parallel Systems Lecture 09 Defining Correctness Claims Gerar Schneider Department of Informatics University of Oslo INF5140, Spring 2007 Gerar Schneider (Ifi,
More informationCopyright 2008 CS655 System Modeling and Analysis. Korea Advanced Institute of Science and Technology
The Spin Model Checker : Part I Copyright 2008 CS655 System Korea Advanced Institute of Science and Technology System Spec. In Promela Req. Spec. In LTL Overview of the Spin Architecture Spin Model pan.c
More informationMP 6 Modeling in Promela and SPIN
MP 6 Modeling in Promela and SPIN CS 477 Spring 2018 Revision 1.0 Assigned April 23, 2018 Due May 2, 2018, 9:00 PM Extension 48 hours (penalty 20% of total points possible) 1 Change Log 1.0 Initial Release.
More informationDesign and Analysis of Distributed Interacting Systems
Design and Analysis of Distributed Interacting Systems Lecture 5 Linear Temporal Logic (cont.) Prof. Dr. Joel Greenyer May 2, 2013 (Last Time:) LTL Semantics (Informally) LTL Formulae are interpreted on
More informationA Tutorial on Model Checker SPIN
A Tutorial on Model Checker SPIN Instructor: Hao Zheng Department of Computer Science and Engineering University of South Florida Tampa, FL 33620 Email: haozheng@usf.edu Phone: (813)974-4757 Fax: (813)974-5456
More informationMulti-Threaded System int x, y, r; int *p, *q, *z; int **a; EEC 421/521: Software Engineering. Thread Interleaving SPIN. Model Checking using SPIN
EEC 421/521: Software Engineering Model Checking using SPIN 4/29/08 EEC 421/521: Software Engineering 1 Multi-Threaded System int x, y, r; int *p, *q, *z; int **a; thread_1(void) /* initialize p, q, and
More informationEMBEDDED C CODE 17. SPIN Version 4 supports the inclusion of embedded C code into PROMELA models through the following fiv e new primitives:
EMBEDDED C CODE 17 The purpose of analysis is not to compel belief but rather to suggest doubt. (Imre Lakatos, Proofs and Refutations) SPIN Version 4 supports the inclusion of embedded C code into PROMELA
More informationModel-Checking Concurrent Systems. The Model Checker Spin. The Model Checker Spin. Wolfgang Schreiner
Model-Checking Concurrent Systems Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at 1.
More informationComputer Lab 1: Model Checking and Logic Synthesis using Spin (lab)
Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab) Richard M. Murray Nok Wongpiromsarn Ufuk Topcu California Institute of Technology EECI 19 Mar 2013 Outline Spin model checker: modeling
More informationDistributed Systems Programming (F21DS1) SPIN: Formal Analysis I
Distributed Systems Programming (F21DS1) SPIN: Formal Analysis I Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview Introduce
More informationDistributed Systems Programming (F21DS1) SPIN: Formal Analysis II
Distributed Systems Programming (F21DS1) SPIN: Formal Analysis II Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview Introduce
More informationApplications of Formal Verification
Applications of Formal Verification Model Checking: Introduction to PROMELA Bernhard Beckert Mattias Ulbrich SS 2017 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State of Baden-Württemberg
More informationFormal Specification and Verification
Formal Specification and Verification Model Checking with Temporal Logic Bernhard Beckert Based on a lecture by Wolfgang Ahrendt and Reiner Hähnle at Chalmers University, Göteborg Formal Specification
More informationApplications of Formal Verification
Applications of Formal Verification Model Checking: Introduction to PROMELA Prof. Dr. Bernhard Beckert Dr. Vladimir Klebanov SS 2012 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State
More informationUsing Spin to Help Teach Concurrent Programming
Using Spin to Help Teach Concurrent Programming John Regehr May 1, 1998 1 Introduction and Motivation Writing correct concurrent programs is very difficult; race conditions, deadlocks, and livelocks can
More informationNetwork Protocol Design and Evaluation
Network Protocol Design and Evaluation 05 - Validation, Part I Stefan Rührup Summer 2009 Overview In the last lectures: Specification of protocols and data/message formats In this chapter: Building a validation
More informationFormal Methods for Software Development
Formal Methods for Software Development Model Checking with Temporal Logic Wolfgang Ahrendt 21st September 2018 FMSD: Model Checking with Temporal Logic /GU 180921 1 / 37 Model Checking Check whether a
More informationCS477 Formal Software Development Methods / 32
CS477 Formal Software Development Methods 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 SPIN Beginners Tutorial April 13, 2018 Assertion Violation: mutextwrong1.pml bit flag;
More informationFormal Specification and Verification
Formal Specification and Verification Introduction to Promela Bernhard Beckert Based on a lecture by Wolfgang Ahrendt and Reiner Hähnle at Chalmers University, Göteborg Formal Specification and Verification:
More informationModel-Checking Concurrent Systems
Model-Checking Concurrent Systems Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at Wolfgang
More informationSoftware Engineering using Formal Methods
Software Engineering using Formal Methods Introduction to Promela Wolfgang Ahrendt & Richard Bubel & Reiner Hähnle & Wojciech Mostowski 31 August 2011 SEFM: Promela /GU 110831 1 / 35 Towards Model Checking
More informationSoftware Engineering using Formal Methods
Software Engineering using Formal Methods Introduction to Promela Wolfgang Ahrendt 03 September 2015 SEFM: Promela /GU 150903 1 / 36 Towards Model Checking System Model Promela Program byte n = 0; active
More informationApplications of Formal Verification
Applications of Formal Verification Model Checking: Introduction to PROMELA Prof. Dr. Bernhard Beckert Dr. Vladimir Klebanov SS 2010 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State
More informationAutomated Reasoning. Model Checking with SPIN (II)
Automated Reasoning Model Checking with SPIN (II) Alan Bundy page 1 Verifying Global Properties Assertions can be used to verify a property locally For example, place assert(memreturned) at the end of
More informationSPIN: Part /614 Bug Catching: Automated Program Verification. Sagar Chaki November 12, Carnegie Mellon University
SPIN: Part 1 15-414/614 Bug Catching: Automated Program Verification Sagar Chaki November 12, 2012 What is This All About? Spin On-the-fly verifier developed at Bell-labs by Gerard Holzmann and others
More information4/6/2011. Model Checking. Encoding test specifications. Model Checking. Encoding test specifications. Model Checking CS 4271
Mel Checking LTL Property System Mel Mel Checking CS 4271 Mel Checking OR Abhik Roychoudhury http://www.comp.nus.edu.sg/~abhik Yes No, with Counter-example trace 2 Recap: Mel Checking for mel-based testing
More informationPromela and SPIN. Mads Dam Dept. Microelectronics and Information Technology Royal Institute of Technology, KTH. Promela and SPIN
Promela and SPIN Mads Dam Dept. Microelectronics and Information Technology Royal Institute of Technology, KTH Promela and SPIN Promela (Protocol Meta Language): Language for modelling discrete, event-driven
More informationLogic Model Checking
Logic Model Checking Lecture Notes 17:18 Caltech 101b.2 January-March 2005 Course Text: The Spin Model Checker: Primer and Reference Manual Addison-Wesley 2003, ISBN 0-321-22862-6, 608 pgs. checking omega
More informationComputer Aided Verification 2015 The SPIN model checker
Computer Aided Verification 2015 The SPIN model checker Grigory Fedyukovich Universita della Svizzera Italiana March 11, 2015 Material borrowed from Roberto Bruttomesso Outline 1 Introduction 2 PROcess
More informationCS477 Formal Software Development Methods / 39
CS477 Formal Software Development Methods 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 SPIN Beginners Tutorial April 11, 2018 Hello World /* A "Hello World" Promela model for
More informationLecture 3 SPIN and Promela
Lecture 3 SPIN and Promela 1 What is SPIN(Simple Promela INterpreter) A tool for analyzing mels of concurrent systems Mels described in Promela Language with concurrent processes Communication via shared
More informationA Practical approach on Model checking with Modex and Spin
International Journal of Electrical & Computer Sciences IJECS-IJENS Vol: 11 No: 05 1 A Practical approach on Model checking with Modex and Spin Muhammad Iqbal Hossain #1, Nahida Sultana Chowdhury *2 #
More informationProving Dekker with SPIN and PROMELA
15-410...fairness disabled... Proving Dekker with SPIN and PROMELA Joshua Wise With help from Greg Hartman L36_SPIN 1 Synchronization Project 4 due Wednesday Everyone having fun? Kernel interviews If you
More informationHSF-SPIN User Manual
HSF-SPIN User Manual Institut für Informatik Albert-Ludwigs-Universität Georges-Köhler-Allee D-79110 Freiburg email: {edelkamp,lafuente}@informatik.uni-freiburg.de March 22, 2006 Contents 1 Introduction
More informationTHE MODEL CHECKER SPIN
THE MODEL CHECKER SPIN Shin Hong, KAIST 17 th April,2007 1/33 Contents Introduction PROMELA Linear Temporal Logic Automata-theoretic software verification Example : Simple Elevator 2 SPIN is a software
More informationSpin: Overview of PROMELA
Spin: Overview of PROMELA Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/~trentin Formal Methods Lab Class, Mar 04, 2016 These slides are derived from those by Stefano Tonetta, Alberto Griggio,
More informationSpin: Overview of PROMELA
Spin: Overview of PROMELA Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/trentin Formal Methods Lab Class, March 10, 2017 These slides are derived from those by Stefano Tonetta, Alberto
More informationModel checking Timber program. Paweł Pietrzak
Model checking Timber program Paweł Pietrzak 1 Outline Background on model checking (spam?) The SPIN model checker An exercise in SPIN - model checking Timber Deriving finite models from Timber programs
More informationNetwork Protocol Design and Evaluation
Network Protocol Design and Evaluation 05 - Validation, Part III Stefan Rührup Summer 2009 Overview In the first parts of this chapter: Validation models in Promela Defining and checking correctness claims
More informationThe Design of a Distributed Model Checking Algorithm for Spin
The Design of a Distributed Model Checking Algorithm for Spin Gerard J. Holzmann http://eis.jpl.nasa.gov/lars http://spinroot.com/gerard/ Presented at FMCAD 2006, San Jose, California November 14, 2006
More informationLTL Reasoning: How It Works
Distributed Systems rogramming F21DS1 LTL Reasoning: How It Works Andrew Ireland School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Distributed Systems rogramming F21DS1 2 Overview
More informationSPIN, PETERSON AND BAKERY LOCKS
Concurrent Programs reasoning about their execution proving correctness start by considering execution sequences CS4021/4521 2018 jones@scss.tcd.ie School of Computer Science and Statistics, Trinity College
More informationINF672 Protocol Safety and Verification. Karthik Bhargavan Xavier Rival Thomas Clausen
INF672 Protocol Safety and Verication Karthik Bhargavan Xavier Rival Thomas Clausen 1 Course Outline Lecture 1 [Today, Sep 15] Introduction, Motivating Examples Lectures 2-4 [Sep 22,29, Oct 6] Network
More informationOn Nested Depth First Search
DIMACS Series in Discrete Mathematics and Theoretical Computer Science Volume 32, 1997 On Nested Depth First Search Gerard J. Holzmann, Doron Peled, and Mihalis Yannakakis The SPIN. ABSTRACT. We show in
More informationDistributed Systems Programming (F21DS1) SPIN: Simple Promela INterpreter
Distributed Systems Programming (F21DS1) SPIN: Simple Promela INterpreter Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview
More informationWhat is SPIN(Simple Promela Interpreter) Elements of Promela. Material About SPIN. Basic Variables and Types. Typical Structure of Promela Model
What is SPIN(Simple Promela Interpreter) Lecture XX SPIN and Promela A tool for analyzing mels of reactive systems Mels described in Promela Language with concurrent processes, Communication via channels,
More informationDesign of Internet Protocols:
CSCI 234 Design of Internet Protocols: George Blankenship George Blankenship 1 Outline Verication and Validation History and motivation Spin Promela language Promela model George Blankenship 2 Verication
More informationFormal Modeling for Persistence Checking of Signal Transition Graph Specification with Promela
, March 15-17, 2017, Hong Kong Formal Modeling for Persistence Checking of Signal Transition Graph Specification with Promela Kanut Boonroeangkaow, Arthit Thongtak and Wiwat Vatanawood Abstract Signal
More informationTRIAL-EXAM Software Engineering using Formal Methods TDA293 (TDA292) / DIT270. Only dictionaries may be used. Other aids are not allowed!
TRIAL-EXAM Software Engineering using Formal Methods TDA293 (TDA292) / DIT270 Extra aid: Only dictionaries may be used. Other aids are not allowed! Please observe the following: This exam has 14 numbered
More informationLogic Model Checking
Logic Model Checking Lecture Notes 14:18 Caltech 118 January-March 2006 Course Text: The Spin Model Checker: Primer and Reference Manual Addison-Wesley 2003, ISBN 0-321-22862-6, 608 pgs. Logic Model Checking
More informationFORMAL METHODS IN NETWORKING COMPUTER SCIENCE 598D, SPRING 2010 PRINCETON UNIVERSITY LIGHTWEIGHT MODELING IN PROMELA/SPIN AND ALLOY
FORMAL METHODS IN NETWORKING COMPUTER SCIENCE 598D, SPRING 2010 PRINCETON UNIVERSITY LIGHTWEIGHT MODELING IN PROMELA/SPIN AND ALLOY Pamela Zave AT&T Laboratories Research Florham Park, New Jersey, USA
More informationModel Requirements and JAVA Programs MVP 2 1
Model Requirements and JAVA Programs MVP 2 1 Traditional Software The Waterfall Model Problem Area Development Analysis REVIEWS Design Implementation Costly wrt time and money. Errors are found too late
More informationWhat is SPIN(Simple Promela Interpreter) Material About SPIN. Elements of Promela. Basic Variables and Types. Typical Structure of Promela Model
What is SPIN(Simple Promela Interpreter) Lecture 3 SPIN and Promela A tool for analyzing mels of reactive systems Mels described in Promela Language with concurrent processes, Communication via channels,
More informationAutomata-Theoretic LTL Model Checking. Emptiness of Büchi Automata
Automata-Theoretic LTL Model Checking Graph Algorithms for Software Model Checking (based on Arie Gurfinkel s csc2108 project) Automata-Theoretic LTL Model Checking p.1 Emptiness of Büchi Automata An automation
More informationDistributed Systems Programming F29NM1 2. Promela I. Andrew Ireland. School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh
Distributed Systems Programming F29NM1 Promela I Andrew Ireland School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Distributed Systems Programming F29NM1 2 Overview Basic building
More informationSystem Correctness. EEC 421/521: Software Engineering. System Correctness. The Problem at Hand. A system is correct when it meets its requirements
System Correctness EEC 421/521: Software Engineering A Whirlwind Intro to Software Model Checking A system is correct when it meets its requirements a design without requirements cannot be right or wrong,
More informationDistributed Systems Programming (F21DS1) Formal Verification
Distributed Systems Programming (F21DS1) Formal Verification Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview Focus on
More informationLecture 10: Nested Depth First Search, Counter- Example Generation Revisited, Bit-State Hashing, On-The-Fly Model Checking
CS 267: Automated Verification Lecture 10: Nested Depth First Search, Counter- Example Generation Revisited, Bit-State Hashing, On-The-Fly Model Checking Instructor: Tevfik Bultan Buchi Automata Language
More informationTRIAL-EXAM Software Engineering using Formal Methods TDA293 (TDA292) / DIT270. Only dictionaries may be used. Other aids are not allowed!
TRIAL-EXAM Software Engineering using Formal Methods TDA293 (TDA292) / DIT270 Extra aid: Only dictionaries may be used. Other aids are not allowed! Please observe the following: This exam has 15 numbered
More informationFormal Verification by Model Checking
Formal Verication by Model Checking Jonathan Aldrich Carnegie Mellon University Based on slides developed by Natasha Sharygina 17-654/17-754: Analysis of Software Artacts Spring 2006 1 CTL Model Checking
More informationA Verification Approach for GALS Integration of Synchronous Components
GALS 2005 Preliminary Version A Verification Approach for GALS Integration of Synchronous Components F. Doucet, M. Menarini, I. H. Krüger and R. Gupta 1 Computer Science and Engineering University of California,
More informationFORMAL METHODS IN NETWORKING COMPUTER SCIENCE 598D, SPRING 2010 PRINCETON UNIVERSITY LIGHTWEIGHT MODELING IN PROMELA/SPIN AND ALLOY
FORMAL METHODS IN NETWORKING COMPUTER SCIENCE 598D, SPRING 2010 PRINCETON UNIVERSITY LIGHTWEIGHT MODELING IN PROMELA/SPIN AND ALLOY Pamela Zave AT&T Laboratories Research Florham Park, New Jersey, USA
More informationResearch Collection. Formal background and algorithms. Other Conference Item. ETH Library. Author(s): Biere, Armin. Publication Date: 2001
Research Collection Other Conference Item Formal background and algorithms Author(s): Biere, Armin Publication Date: 2001 Permanent Link: https://doi.org/10.3929/ethz-a-004239730 Rights / License: In Copyright
More informationModel Checking DSL-Generated C Source Code
Model Checking DSL-Generated C Source Code Martin Sulzmann and Axel Zechner Informatik Consulting Systems AG, Germany {martin.sulzmann,axel.zechner}@ics-ag.de Abstract. We report on the application of
More informationT Parallel and Distributed Systems (4 ECTS)
T 79.4301 Parallel and Distributed Systems (4 ECTS) T 79.4301 Rinnakkaiset ja hajautetut järjestelmät (4 op) Lecture 3 4th of February 2008 Keijo Heljanko Keijo.Heljanko@tkk.fi T 79.4301 Parallel and Distributed
More informationSWEN-220 Mathematical Models of Software. Concurrency in SPIN Interleaving
SWEN-220 Mathematical Models of Software Concurrency in SPIN Interleaving 1 Topics Interleaving Process Interference Race Conditions Atomicity 2 Concurrency Concurrency can come in many flavors Concurrent
More informationMapping of UML Diagrams to Extended Petri Nets for Formal Verification
Grand Valley State University ScholarWorks@GVSU Masters Theses Graduate Research and Creative Practice 8-2013 Mapping of UML Diagrams to Exted Petri Nets for Formal Verification Byron DeVries Grand Valley
More informationBuilding Graphical Promela Models using UPPAAL GUI
Building Graphical Promela Models using UPPAAL GUI Master s Thesis Report by Vasu Hossaholal Lingegowda Software Systems Engineering Group: B2-201 under the guidance of Dr. Alexandre David Department of
More informationHello World. Slides mostly a reproduction of Theo C. Ruys SPIN Beginners Tutorial April 23, Hello() print "Hello"
Hello World CS477 Formal Software Development Methods 11 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 inners April 3, 014 /* A "Hello World" Promela model for SPIN. */ active Hello()
More informationModeling Interactions of Web Software
Modeling Interactions of Web Software Tevfik Bultan Department of Computer Science University of California Santa Barbara, CA 9106 bultan@cs.ucsb.edu Abstract Modeling interactions among software components
More informationCS5232 Formal Specification and Design Techniques. Using PAT to verify the Needham-Schroeder Public Key Protocol
CS5232 Formal Specification and Design Techniques Using PAT to verify the Needham-Schroeder Public Key Protocol Semester 2, AY 2008/2009 1/37 Table of Contents 1. Project Introduction 3 2. Building the
More informationAutomatic Verification of Multiagent Conversations
Automatic Verification of Multiagent Conversations Timothy Lacey and Scott A. DeLoach Air Force Institute of Technology Graduate School of Engineering and Management Department of Electrical and Computer
More informationT Parallel and Distributed Systems (4 ECTS)
T 79.4301 Parallel and Distriuted Systems (4 ECTS) T 79.4301 Rinnakkaiset ja hajautetut järjestelmät (4 op) Lecture 4 11th of Feruary 2008 Keijo Heljanko Keijo.Heljanko@tkk.fi T 79.4301 Parallel and Distriuted
More informationModel Checking with Automata An Overview
Model Checking with Automata An Overview Vanessa D Carson Control and Dynamical Systems, Caltech Doyle Group Presentation, 05/02/2008 VC 1 Contents Motivation Overview Software Verification Techniques
More informationwant turn==me wait req2==0
Uppaal2k: Small Tutorial Λ 16 October 2002 1 Introduction This document is intended to be used by new comers to Uppaal and verification. Students or engineers with little background in formal methods should
More informationTemporal Logic and Timed Automata
Information Systems Analysis Temporal Logic and Timed Automata (5) UPPAAL timed automata Paweł Głuchowski, Wrocław University of Technology version 2.3 Contents of the lecture Tools for automatic verification
More informationMore on Verification and Model Checking
More on Verification and Model Checking Wednesday Oct 07, 2015 Philipp Rümmer Uppsala University Philipp.Ruemmer@it.uu.se 1/60 Course fair! 2/60 Exam st October 21, 8:00 13:00 If you want to participate,
More informationSPIN. Carla Ferreira.
SPIN Carla Ferreira http://www.spinroot.com/spin/man/intro.html Introduction PROMELA (PROcess MEta LAnguage) is the input language of SPIN (Simple Promela Interpreter) Inspired by: C and CSP Describes
More informationTesting Concurrent Programs: Model Checking SPIN. Bengt Jonsson
Testing Concurrent Programs: Model Checking SPIN Bengt Jonsson Model Checking Section Weeks 15 and 16. Goal: Understand and use the basics of Model checking, using state space exploration Modeling parallel
More informationMINIX 3 Process Analysis
Xander Damen Albert Gerritsen Eelis van der Weegen 2010-01-18 Introduction Our project: process analysis of MINIX 3. Outline: 1 methodology 2 subsystem & tool selection 3 the MINIX 3 scheduler 4 the model
More informationSPIN part 2. Verification with LTL. Jaime Ramos. Departamento de Matemática, Técnico, ULisboa
SPIN part 2 Verification with LTL Jaime Ramos Departamento de Matemática, Técnico, ULisboa Borrowed from slides by David Henriques, Técnico, ULisboa LTL model checking How Spin works Checks non-empty intersection
More informationLeveraging DTrace for runtime verification
Leveraging DTrace for runtime verification Carl Martin Rosenberg June 7th, 2016 Department of Informatics, University of Oslo Context: Runtime verification Desired properties System Every request gets
More informationModeling a Cache Coherence Protocol with the Guarded Action Language
Modeling a Cache Coherence Protocol with the Guarded Action Language Quentin Meunier, Yann Thierry-Mieg, Emmanuelle Encrenaz Laboratoire d Informatique de Paris 6, Sorbonne Université, Paris. The TeraScale
More informationThe UPPAAL Model Checker. Julián Proenza Systems, Robotics and Vision Group. UIB. SPAIN
The UPPAAL Model Checker Julián Proenza Systems, Robotics and Vision Group. UIB. SPAIN The aim of this presentation Introduce the basic concepts of model checking from a practical perspective Describe
More informationSWEN-220 Mathematical Models of Software. Process Synchronization Critical Section & Semaphores
SWEN-220 Mathematical Models of Software Process Synchronization Critical Section & Semaphores 1 Topics The critical section Synchronization using busy-wait Semaphores 2 The Critical Section Processes
More informationModeling and Verification of Extensible Authentication Protocol for Transport Layer Security in Wireless LAN Environment
Modeling and Verification of Extensible Authentication Protocol for Transport Layer Security in Wireless LAN Environment Humayra Binte Ali School of CSEM, Flinders University ali0041@flinders.edu.au Manzur
More informationIntroduction to Model Checking
Introduction to Model Checking René Thiemann Institute of Computer Science University of Innsbruck WS 2007/2008 RT (ICS @ UIBK) week 4 1/23 Outline Promela - Syntax and Intuitive Meaning Promela - Formal
More informationT Reactive Systems: Kripke Structures and Automata
Tik-79.186 Reactive Systems 1 T-79.186 Reactive Systems: Kripke Structures and Automata Spring 2005, Lecture 3 January 31, 2005 Tik-79.186 Reactive Systems 2 Properties of systems invariants: the system
More informationG52CON: Concepts of Concurrency
G52CON: Concepts of Concurrency Lecture 6: Algorithms for Mutual Natasha Alechina School of Computer Science nza@cs.nott.ac.uk Outline of this lecture mutual exclusion with standard instructions example:
More informationJava PathFinder JPF 2 Second Generation of Java Model Checker
Java PathFinder JPF 2 Second Generation of Java Model Checker Guenther Brand Mat. Nr. 9430535 27. 06. 2003 Abstract This essay is based on the papers Java PathFinder, Second Generation of Java Model Checker
More informationFormal modelling and verification in UPPAAL
Budapest University of Technology and Economics Department of Measurement and Information Systems Fault Tolerant Systems Research Group Critical Embedded Systems Formal modelling and verification in UPPAAL
More information